Lightweight Directory Access Protocol (LDAP)

The Lightweight Directory Access Protocol (LDAP) is an open standard for querying and managing directory information over IP networks. Defined in IETF RFC 4511, it provides a structured, hierarchical store of users, groups, and organizational objects. LDAP underpins identity systems like Microsoft Active Directory, OpenLDAP, and FreeIPA, serving as the foundational user directory behind many SSO and IAM platforms.

Key Capabilities

• Hierarchical directory model: Organizes identity data in a tree-like structure of Distinguished Names (DNs), where each node represents an object such as a user, group, or organizational unit.

• Flexible schema: Supports standardized and extensible object classes like inetOrgPerson, groupOfNames, and custom schema definitions to fit diverse organizational requirements.

• Multiple authentication methods: Allows authentication through simple bind (username/password), SASL mechanisms (e.g., Kerberos), or TLS-encrypted sessions using ldaps:// for secure communication.

• High interoperability: Widely supported across major directory implementations, including Active Directory, OpenLDAP, FreeIPA, and JumpCloud Directory Platform.

Limitations

• Authentication only (no federation): LDAP handles identity lookup and password validation but does not issue SAML, OIDC, or OAuth 2.0 tokens. Federation requires integration with an external IdP such as Keycloak or ADFS.

• Security configuration requirements: Standard LDAP (ldap://) transmits credentials in plaintext and must be secured using LDAPS or StartTLS for production environments.

• Replication and HA complexity: Ensuring high availability and multi-region synchronization requires manual setup and careful schema consistency management.

• No SCIM interface: LDAP predates modern identity lifecycle standards; there is no confirmed native SCIM 2.0 support in most implementations.

• Limited MFA or adaptive access: LDAP natively verifies credentials only and does not provide multi-factor or risk-based authentication; these capabilities are typically added through IdPs or PAM extensions.